Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
Detects the presence of a file with a specific SHA-256 hash associated with a Linux Sliver TCP Pivot implant. This implant has been linked to the CL-CRI-1036 group and is used as a precursor to 01flip ransomware deployment. The rule searches across file and process events for this high-fidelity indicator of compromise.
Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.
This rule detects a specific sequence of commands often used by ransomware, particularly the '01flip' variant, to self-delete after execution. The sequence involves 'ping.exe' for a delay, 'fsutil.exe' to zero out file data, and 'cmd.exe' to delete files. The rule correlates these events within a short timeframe, initiated by the same process on a given device.
Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects Microsoft Excel spawning an executable in a typical malware staging directory directory. This behavior is a strong indicator of a malicious XLL loader used by the Paper Werewolf (GOFFEE) group to drop the EchoGather backdoor.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
Detects the renaming of VMware virtual machine related files to a new file ending with the '.emario' extension. This behavior is characteristic of the RansomHouse 'Mario' encryptor.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects the mass creation of the 'RECOVER-YOUR-FILE.TXT' ransom note, a behavior characteristic of the 01flip ransomware. A high count of these notes on a single host is a strong indicator of compromise, suggesting that data has been encrypted for impact.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This rule detects suspicious network connections to known malicious URLs associated with a Docker Desktop malware campaign. It also identifies instances where 'DockerDesktop.exe' is executed or present in unusual file paths, suggesting potential masquerading or unauthorized deployment outside of its standard installation directory. The rule is broken into three parts: network events, file events, and process events. The network part looks for connections to specific malicious domains. The file and process parts look for 'DockerDesktop.exe' in folders other than the assumed legitimate installation path, indicating potential malicious activity.
Detects the ransom note file 'How To Restore Your Files.txt' created by the RansomHouse 'Mario' encryptor.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
Detects the ZinFoq Go-based post-exploitation implant. This rule identifies the binary based on a unique, hardcoded timestamp string used for its timestomping anti-forensics feature, along with other specific C2 artifacts.
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
Page 177 of 232